CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

EUVD-2026-61485

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

CVE-2026-53454

Prior to version 2.5.2, Blueprint Studio configured Git's credential.helper store, writing usernames and access tokens in plaintext to a .git-credentials file accessible to other users/processes on the same filesystem, exposing Home Assistant Git credentials; the issue is fixed in 2.5.2. No explo...

CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

CVE-2026-53454: Insufficiently Protected Credentials

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

PT-2026-77315

Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2 Description Blueprint Studio generates a shell-based Git credential helper in the custom components/blueprint studio/backend/git manager.py file by interpolating the configured Git username and token...

EUVD-2026-60256

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: prometheus-blackbox-exporter, kaf, gosu-fips, sbom-convert, argo-cd, petname, gops-fips, pushprox, openbao-k8s-fips, kubevela, monstache, newrelic-nri-statsd, blob-csi, metrics-server, dataplaneapi-fips, http-echo, step-kms-plugin, dapr, oauth2-proxy-fips, harbor,...

GO-2025-4009 vulnerabilities

Vulnerabilities for packages: prometheus-blackbox-exporter, kaf, gosu-fips, sbom-convert, argo-cd, petname, gops-fips, pushprox, openbao-k8s-fips, kubevela, monstache, newrelic-nri-statsd, blob-csi, metrics-server, dataplaneapi-fips, http-echo, step-kms-plugin, dapr, oauth2-proxy-fips, harbor,...

SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines

Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below - gitcredentialmanager versions 2.8.0...

Medium: amazon-ssm-agent

Issue Overview: go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0...

Ubuntu 16.04 LTS / 18.04 LTS : Git vulnerabilities (USN-7964-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7964-1 advisory. It was discovered that Git did not properly sanitize URLs when asking for credentials via a terminal prompt. An attacker could possibly use...

USN-7964-1 git vulnerabilities

It was discovered that Git did not properly sanitize URLs when asking for credentials via a terminal prompt. An attacker could possibly use this issue to trick a user into disclosing their password. CVE-2024-50349 It was discovered that Git did not properly handle carriage return characters in it...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: elvish, velero-plugin-for-microsoft-azure, kubernetes-replicator, bom, cluster-api-gcp-controller, manifest-tool, flyte, helm-mapkubeapis, kube-vip-cloud-provider, k3d, terraform-provider-tls, docker-machine-driver-harvester, ko, stern, terraform-provider-random,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: elvish, velero-plugin-for-microsoft-azure, kubernetes-replicator, bom, cluster-api-gcp-controller, manifest-tool, flyte, helm-mapkubeapis, kube-vip-cloud-provider, k3d, terraform-provider-tls, docker-machine-driver-harvester, ko, stern, terraform-provider-random,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: elvish, velero-plugin-for-microsoft-azure, kubernetes-replicator, bom, cluster-api-gcp-controller, manifest-tool, flyte, helm-mapkubeapis, kube-vip-cloud-provider, k3d, terraform-provider-tls, docker-machine-driver-harvester, ko, stern, terraform-provider-random,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: elvish, velero-plugin-for-microsoft-azure, kubernetes-replicator, bom, cluster-api-gcp-controller, manifest-tool, flyte, helm-mapkubeapis, kube-vip-cloud-provider, k3d, terraform-provider-tls, docker-machine-driver-harvester, ko, stern, terraform-provider-random,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: elvish, velero-plugin-for-microsoft-azure, kubernetes-replicator, bom, cluster-api-gcp-controller, manifest-tool, flyte, helm-mapkubeapis, kube-vip-cloud-provider, k3d, terraform-provider-tls, docker-machine-driver-harvester, ko, stern, terraform-provider-random,...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: elvish, velero-plugin-for-microsoft-azure, kubernetes-replicator, bom, cluster-api-gcp-controller, manifest-tool, flyte, helm-mapkubeapis, kube-vip-cloud-provider, k3d, terraform-provider-tls, docker-machine-driver-harvester, ko, stern, terraform-provider-random,...